mirror of
https://git.proxmox.com/git/pve-manager
synced 2025-08-13 15:49:24 +00:00
c92fc8a1e8
We get the device list from ceph-volume lvm list, and decode the json
output, which at that point is tainted (perlsec (1)).
Untaint it here before calling, because it is currently the only
call-site using the information in a problematic way (run_command).
(the only other call-site being in pve5to6)
Alternatively we could untaint while reading the information, but then
should only return a small subset of the ceph-volume output.
The issue is most likely due to
cb9db10c1a9855cf40ff13e81f9dd97d6a9b2698 in pve-common ('run_command:
improve performance for logging and long lines'),
Tested on a virtual testsetup by creating OSDs with second DB disk,
and destroying it via GUI (did not manage to get the error without the
DB disk)
Reported via our community forum:
https://forum.proxmox.com/threads/insecure-dependency-in-exec-during-osd-destroy.79574/
Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
|
||
|---|---|---|
| aplinfo | ||
| bin | ||
| configs | ||
| debian | ||
| network-hooks | ||
| PVE | ||
| services | ||
| test | ||
| www | ||
| .gitignore | ||
| defines.mk | ||
| Makefile | ||
| spice-example-sh | ||
| vzdump-hook-script.pl | ||